http: session/login reject disabled users; mid-session disable kicks immediately

2026-05-05 09:22:07 +01:00
parent c1e974aad9
commit cbdd94ca12
4 changed files with 60 additions and 0 deletions
@@ -59,6 +59,9 @@ func (s *Server) authenticateAndSession(w stdhttp.ResponseWriter, r *stdhttp.Req
 	if err := auth.VerifyPassword(u.PasswordHash, password); err != nil {
 		return nil, errInvalidCredentials
 	}
+	if u.DisabledAt != nil {
+		return nil, errInvalidCredentials
+	}

 	token, err := auth.NewToken()
 	if err != nil {